AtentumZero/Azure-BlueTeam-Toolkit

A collection of KQL queries for running security monitoring in Microsoft Azure using Azure Sentinel and 365 Defender Advanced Hunting.

Azure-BlueTeam-Toolkit

This repository is a collection of custom Kusto Query Language (KQL) queries for running security monitoring in Microsoft's Azure cloud hosting platform. Some require some customisation before use, there are comments next to variables that require customisation detailing what steps to take.

These queries are primarily designed for use in the Azure Sentinel and 365 Defender, although they could also form the basis of queries for use in other tools that accept KQL like Microsoft Advanced Threat Protection (ATP).

Microsoft Sentinel queries

• General
• Active Directory
• Azure Active Directory
• Azure Key Vault
• Defender for Endpoint
• Office 365
• AWS CloudTrail

Defender 365 Advanced Hunting queries

• Email
• Networking
• Post-compromise
• Ransomware

Attribution

Queries in this repo are a mixture of self-written Kusto and code originally obtained from reprise99 and lawndoc.